Medium WID-SEC-2023-0067 43 CVEs

Oracle MySQL: Mehrere Schwachstellen

Published Jan 19, 2021 · Updated Jan 11, 2023 · Revision 8 · de-DE

Vendor: gentoo Vendor: Juniper Networks Vendor: NETAPP Vendor: Oracle Vendor: Red Hat Vendor: Ubuntu Product: ActiveIQ Unified Manager Product: Contrail Service Orchestration Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: MySQL Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Verfügbarkeit, Vertraulichkeit und Integrität zu gefährden.

Product

MySQL ist ein Open Source Datenbankserver von Oracle.

Vulnerabilities 43

High 8.7

CVE-2020-5421 Public exploit EPSS 12%

RFD Protection Bypass via jsessionid

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid pa…

Spring by VMware Spring Framework libspring-java libspring-java Debian Ubuntu Maven

Sep 19, 2020
High 7.3

CVE-2019-10086 EPSS 29%

Insecure Deserialization in Apache Commons Beanutils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default chara…

Apache Apache Commons Beanutils trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven

Aug 20, 2019
Medium 6.8

CVE-2021-2046

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 6.5

CVE-2020-5408

Dictionary attack with Spring Security queryable text encryptor

Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious…

Spring by VMware Spring Security org.springframework.security:spring-security-core Maven

May 14, 2020
Medium 6.5

CVE-2021-2020

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 6.5

CVE-2021-2024

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 5.9

CVE-2020-1971 Public exploit

EDIPARTYNAME NULL pointer dereference

The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equa…

OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine

Dec 8, 2020
Medium 5.9

CVE-2021-2011

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 5.3

CVE-2021-2006

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 5.0

CVE-2021-2048

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2001

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2002

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2009

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2012

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2014

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin). Supported versions that…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2016

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2021 EPSS 10%

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2028

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2030

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2031

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2036

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2055

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2058

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are aff…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2060

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2065

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2070

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2072

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2076

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2081

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.9

CVE-2021-2122

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.4

CVE-2021-2022

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Debian Ubuntu

Jan 20, 2021
Medium 4.4

CVE-2021-2038

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions …

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.4

CVE-2021-2056

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.4

CVE-2021-2061

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.4

CVE-2021-2087

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.4

CVE-2021-2088

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.3

CVE-2021-2032

Vulnerability in the MySQL Server product of Oracle MySQL (component: Information Schema). Supported versions that are …

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Medium 4.2

CVE-2021-2010

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Low 3.8

CVE-2021-1998

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Low 3.7

CVE-2021-2007

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are …

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Low 2.7

CVE-2021-2019

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Low 2.3

CVE-2021-2042

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu

Jan 20, 2021
Unscored —

CVE-2020-13871

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions …

sqlite3 Debian

Jun 6, 2020

Revision history

2023-01-11 #8
Neue Updates von Juniper aufgenommen
2021-10-12 #7
Neue Updates von Red Hat aufgenommen
2021-09-22 #6
Neue Updates von Oracle Linux aufgenommen
2021-09-20 #5
Neue Updates von Red Hat aufgenommen
2021-06-21 #4
Neue Updates von NetApp aufgenommen
2021-05-25 #3
Neue Updates von Gentoo aufgenommen
2021-02-01 #2
Neue Updates von Ubuntu aufgenommen
2021-01-19 #1
Initiale Fassung

References

Juniper Security Advisory JSA70182 vom 2023-01-12
https://supportportal.juniper.net/s/article/2023-01-Security-Bulletin-Contrail-Service-Orchestration-Multiple-vulnerabilities-resolved-in-CSO-6-3-0?language=en_US
Gentoo Linux Security Advisory GLSA-202105-27 vom 2021-05-26
https://security.gentoo.org/glsa/202105-27
Oracle Critical Patch Update Advisory - January 2021 - Appendix Oracle MySQL vom 2021-01-19
https://www.oracle.com/security-alerts/cpujan2021.html#AppendixMSQL
Ubuntu Security Notice USN-4716-1 vom 2021-02-01
https://usn.ubuntu.com/4716-1
NetApp Security Advisory NTAP-20210622-0001 vom 2021-06-22
https://security.netapp.com/advisory/ntap-20210622-0001/
Red Hat Security Advisory RHSA-2021:3590 vom 2021-09-21
https://access.redhat.com/errata/RHSA-2021:3590
Oracle Linux Security Advisory ELSA-2021-3590 vom 2021-09-23
http://linux.oracle.com/errata/ELSA-2021-3590.html
Red Hat Security Advisory RHSA-2021:3811 vom 2021-10-12
https://access.redhat.com/errata/RHSA-2021:3811